Financial data deserves financial-grade restraint.

Tenant isolation

Every business record — agreements, rules, uploads, findings, decisions — carries a workspace identifier. Access is enforced with row-level security in the database: a query only returns rows belonging to a workspace the signed-in user is a member of. Application code cannot bypass this by mistake, because the database applies the policy regardless of the query.

Elevated service credentials are used only server-side for payment webhooks and scheduled jobs, never from the browser.

Storage and retention

• Uploaded files are written to a private storage bucket by the server. There are no public objects.
• Files are read through short-lived signed URLs generated for the requesting member only.
• You can delete any raw file immediately. Deletion removes the object from storage; it is not merely hidden.
• Raw files that you have not deleted are removed automatically after 30 days.
• Confirmed billing rules, findings, their calculation inputs and steps, and your confirm/reject decisions are retained while the preflight exists, so every result can be replayed and audited.

AI boundary

A language model is used for two narrow tasks: extracting candidate billing terms from an agreement, and proposing which invoice line might correspond to which concept. Its output is validated, labelled as AI-proposed, and stored separately from confirmed rules.

• Nothing the model proposes affects a financial finding until a person confirms it.
• The model never calculates money. All amounts are produced by a deterministic engine from confirmed rules and imported evidence, in integer minor units, with every step recorded.
• Agreement text is sent to the AI provider from our servers only, over encrypted connections, for the duration of the request.

Analytics and monitoring

We record product events (a preflight was created, a rule was confirmed) and application errors so we can keep the service working. These events carry identifiers and timings, not content. Contract excerpts, invoice lines, amounts and file contents are excluded from analytics and error reports.

Access and sessions

• Authentication is handled by our identity provider; passwords are never stored by us in plain form.
• Sessions are cookie-based, HTTP-only, and scoped to the truviate.com origin.
• Workspace membership determines what a user can see and do. Removing a member revokes their access immediately.
• All traffic uses TLS in transit.

Multi-factor authentication and step-up

• Time-based one-time password (TOTP) multi-factor authentication is enrolled before the first document upload.
• Sensitive actions — member management, security settings, workspace deletion — require a recent second-factor verification (AAL2 step-up), not just a valid session.
• Active sessions are listed in the security settings and can be revoked individually.

Audit trail

• Rule confirmations, finding decisions, membership changes and deletions are recorded with who acted and when.
• Findings keep their calculation inputs and steps, so any result can be replayed from stored data.

Retention and purge

• Raw uploads can be deleted immediately by a member and are purged automatically after the retention period.
• Deleting a workspace removes its records; the last owner cannot be removed by accident.

Implemented today, and what is still being finalized

What we don’t claim yet

Truviate has not yet completed a third-party security certification or independent audit. We would rather say that plainly than borrow a badge. The controls above are the ones actually in place; if you need something specific for your own review, ask and we will answer directly.

Responsible disclosure

If you believe you have found a security issue, write to support@truviate.com with enough detail to reproduce it. We acknowledge reports promptly, keep you informed while we investigate, and do not pursue researchers who act in good faith.